Hi Dan, thank you for your useful video. In the "SecurityConfig" class, the `jwt()` method in `OAuth2ResourceServerConfigurer` has been deprecated since version 6.1. To resolve this, I used the `.oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))` configuration and it worked for me.
Hi Dan, great video as always. I have one question though. At 17:00, when creating a @Bean for JwtDecoder, in SecretKeySpec constructor, you are setting "RSA" as alghoritm. Correct me if I'm wrong, but isn't that an asymmetric key encription? Shouldn't we pass something like HmacSHA512? Thanks in advance
I have the same doubt. I was expecting a HMAC but RSA was written. But does this have something to do with sharing the secret key or something where we use the Asymmetric key encryption to do that(Diffie Hellman).
Great video, this is what we needed. It would be great if you can build on top of this one so UsernamePasswordAuthenticationFilter is used along with PostgresDB!
In the given implementation we are using basic login where credential is supplied using authorize header but if we want to do so by using a rest end point how can I do that, anyone please guide.
Hi Dan! (sorry for my bad English). I have watched carefully some of your videos about security, there is one small problem: when restarting the application all the tokens previously issued become invalid. I will be very glad and grateful if you tell me how to solve this problem or make a video like "jwt for production"! I am immensely grateful for your channel, thank you!
Thank you so much for this short and concise tutorial Dan. However, I encountered an error while following along with the tutorial. I get an error when I try to encode with HS512 algorithm. HS256 works fine. The error is below [Request processing failed: org.springframework.security.oauth2.jwt.JwtEncodingException: An error occurred while attempting to encode the Jwt: Failed to sign the JWT -> The HS512 algorithm is not allowed or supported by the JWS signer: Supported algorithms: [HS256]] with root cause com.nimbusds.jose.JOSEException: The HS512 algorithm is not allowed or supported by the JWS signer: Supported algorithms: [HS256]
![Spring Boot 3 + Spring Security 6 - JWT Authentication and Authorisation [NEW] [2023]](/img/n.gif)
Absolutely in love with this Spring Security series. It would be awesome to expand these lessons with the utilization of refresh tokens.
Hi Dan, thank you for your useful video. In the "SecurityConfig" class, the `jwt()` method in `OAuth2ResourceServerConfigurer` has been deprecated since version 6.1. To resolve this, I used the `.oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))` configuration and it worked for me.
Thanks buddy! It helped.
Great. Thanks
Great timing! Just got instructions from my mentor to learn about JWT tomorrow, and implement it in my project! Thank you!
A followup video about refresh token would be awesome.
Great tutorial. Could you expand on this topic and demonstrate how to implement logout functionality and refresh tokens?
Hi Dan, great video as always.
I have one question though.
At 17:00, when creating a @Bean for JwtDecoder, in SecretKeySpec constructor, you are setting "RSA" as alghoritm.
Correct me if I'm wrong, but isn't that an asymmetric key encription?
Shouldn't we pass something like HmacSHA512?
Thanks in advance
I have the same doubt. I was expecting a HMAC but RSA was written. But does this have something to do with sharing the secret key or something where we use the Asymmetric key encryption to do that(Diffie Hellman).
Well done, Thanks Dan
Nice shirt. And lesson of course 👍
Very cool, thank you!
Nice video!
thank you so much sir
Nicely done, may I know your IDE theme?
He's using new beta layout in appearence. Enable beta will give new appearence to IDE just like this. Wanna know his theme also ;)
Great video, this is what we needed.
It would be great if you can build on top of this one so UsernamePasswordAuthenticationFilter is used along with PostgresDB!
Thanks for video! But how to refresh key?
How would you write a refresh token method for that application?
Could you please make a video on common exception library for Spring Webflux projects
What is the advantage of the JWT over just using basic auth here if both endpoints are in the same application?
Hey Dan, what is securityMatcher? How is that different from requestMatcher?
And how to use the symmetric key If i have auth server and resource server in one app :) ?
In the given implementation we are using basic login where credential is supplied using authorize header but if we want to do so by using a rest end point how can I do that, anyone please guide.
Nicely done, Dan! Can you do a tutorial about oauth2Client + JWT?
Hi Dan! (sorry for my bad English). I have watched carefully some of your videos about security, there is one small problem: when restarting the application all the tokens previously issued become invalid. I will be very glad and grateful if you tell me how to solve this problem or make a video like "jwt for production"! I am immensely grateful for your channel, thank you!
you would probably need to store your active tokens in a persistent data storage
Thanks
What's going on with ur teeth? Why are they so white?))
Thank you so much for this short and concise tutorial Dan. However, I encountered an error while following along with the tutorial. I get an error when I try to encode with HS512 algorithm. HS256 works fine. The error is below
[Request processing failed: org.springframework.security.oauth2.jwt.JwtEncodingException: An error occurred while attempting to encode the Jwt: Failed to sign the JWT -> The HS512 algorithm is not allowed or supported by the JWS signer: Supported algorithms: [HS256]] with root cause
com.nimbusds.jose.JOSEException: The HS512 algorithm is not allowed or supported by the JWS signer: Supported algorithms: [HS256]
Had the same issue. Your key is probably not long enough.
Wow thanks for pointing that out
@@hschaeufler How do we generate the correct key?
Probably longer than needed, but with the openssl utility you can do the following
openssl rand -base64 64